We support the development of a university-wide computer Security Policy. While awaiting the development of this, the following are steps the SCF takes in order to help improve computer security for the college and the university.

"Responsible-Use" Policy
We will remind users that such a policy exists. See, for example, under our Support Policy, User Responsibilities.

User Education
We believe generally that OIT should handle the broad aspects of user education on security risks.

We believe that we should be able to quickly find users of particular types of systems, so that we can work with the users when specific vulnerabilities are announced. We also believe that we should be able to locate compromised computers quickly when asked. We thus have made the Inventory Project to be one of our high priorities. We also will encourage the departments to adopt our proposed Network Policy.

We are also developing a list of Security Recommendations, and will advertise this list to users in the college.

System Administration Help
It is a priority for us to be able to help users maintain secure computers. We offer users specific help by installing and maintaining secure Sun, SGI, and Linux operating systems on computers. We also will help users assess the relative security of a particular computer.

Vulnerability Assessment
Since the days when Dr. Henry Harbury first directed SCF, SCF has performed security scans. Information from those scans is used to help identify the insecure systems. We then notify the owner of the vulnerabilities, and ask to help cleanup the system.

Firewalls
We will help advise on request on firewalls for particular computers.

Policy Compliance
When OIT or SCF finds a compromised or insecure computer, the owner is notified. SCF is often asked to help with the cleanup. In some cases, the owner is asked to remove the computer temporarily from the network. In the event that the owner does not comply, we will take the next step of notifying the department chair and then asking Networking to disconnect the computer from the network.